You need the extra label to enable LetsEncrypt TLS for the service. Or you assign LetsEncrypt centrally in your static entrypoint section to websecure.
If your service is listening internally on 8000, then you need .loadbalancer.server.port=8000. Normally you would use a Docker network and connect Traefik and all services to it. You usually don't use ports to expose service ports on the host. Traefik provider.docker uses Docker internal IPs and connects directly.
What does the Traefik debug log tell you?